CVE-2007-1548 EXPLOIT
7.5
HIGH · CVSS 2.0 · EPSS 1.8% (pctl 78)
Patch early
A public exploit exists.
Description
SQL injection vulnerability in functions/functions_filters.asp in Web Wiz Forums before 8.05a (MySQL version) does not properly filter certain characters in SQL commands, which allows remote attackers to execute arbitrary SQL commands via \"' (backslash double-quote quote) sequences, which are collapsed into \'', as demonstrated via the name parameter to forum/pop_up_member_search.asp.
Scoring
| CVSS | 7.5 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| EPSS | 1.79% — more likely to be exploited than 78% of all CVEs |
| Weakness | CWE-89 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2007-03-20 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| webwizguide | web wiz forums |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Web Wiz Forums 8.05 - String Filtering SQL Injection | 2007-03-20 |
References
- http://ifsec.blogspot.com/2007/03/web-wiz-forums-805-mysql-version-sql.html
- http://osvdb.org/34344
- http://secunia.com/advisories/24561
- http://securityreason.com/securityalert/2456
- http://www.securityfocus.com/archive/1/463287/100/0/threaded
- http://www.securityfocus.com/bid/23051
- http://www.vupen.com/english/advisories/2007/1061
- http://www.webwizguide.info/web_wiz_forums/Version%20History.txt
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33095
- http://ifsec.blogspot.com/2007/03/web-wiz-forums-805-mysql-version-sql.html
- http://osvdb.org/34344
- http://secunia.com/advisories/24561
- http://securityreason.com/securityalert/2456
- http://www.securityfocus.com/archive/1/463287/100/0/threaded
- http://www.securityfocus.com/bid/23051
- http://www.vupen.com/english/advisories/2007/1061
- http://www.webwizguide.info/web_wiz_forums/Version%20History.txt
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33095
→ the Explorer · watch your stack · NVD